Collect Deep Instinct EDR logs

This document explains how to ingest Deep Instinct EDR logs to Google Security Operations using Bindplane. The parser extracts fields from Deep Instinct EDR LEEF formatted logs. It uses grok to parse the log message, kv to separate key-value pairs, and then maps these values to the UDM, handling various data transformations and conditional logic for specific fields along the way. It also sets default metadata values for the event source and type.

Before you begin

Make sure you have the following prerequisites:

• Google SecOps instance
• Windows 2016 or later or a Linux host with systemd
• If running behind a proxy, ensure firewall ports are open
• Privileged access to the Deep Instinct Management Console

Get Google SecOps ingestion authentication file

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Collection Agents.
3. Download the Ingestion Authentication File. Save the file securely on the system where Bindplane will be installed.

Get Google SecOps customer ID

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Profile.
3. Copy and save the Customer IDfrom the Organization Detailssection.

Install the Bindplane agent

Install the Bindplane agent on your Windows or Linux operating system according to the following instructions.

Windows installation

1. Open the Command Promptor PowerShellas an administrator.

2. Run the following command:

     msiexec 
     
    / 
    i 
     
    "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" 
     
    / 
    quiet 
    
   

Linux installation

1. Open a terminal with root or sudo privileges.

2. Run the following command:

    sudo  
   sh  
   -c  
    " 
    $( 
   curl  
   -fsSlL  
   https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh ) 
    " 
     
   install_unix.sh 
   

Additional installation resources

For additional installation options, consult the installation guide .

Configure the Bindplane agent to ingest Syslog and send to Google SecOps

1. Access the configuration file:
   • Locate the config.yaml file. Typically, it's in the /etc/bindplane-agent/ directory on Linux or in the installation directory on Windows.
   • Open the file using a text editor (for example, nano , vi , or Notepad).
2. Edit the config.yaml file as follows: yaml receivers: udplog: # Replace the port and IP address as required listen_address: "0.0.0.0:514" exporters: chronicle/chronicle_w_labels: compression: gzip # Adjust the path to the credentials file you downloaded in Step 1 creds_file_path: '/path/to/ingestion-authentication-file.json' # Replace with your actual customer ID from Step 2 customer_id: <customer_id> endpoint: malachiteingestion-pa.googleapis.com # Add optional ingestion labels for better organization log_type: 'DEEP_INSTINCT_EDR' raw_log_field: body ingestion_labels: service: pipelines: logs/source0__chronicle_w_labels-0: receivers: - udplog exporters: - chronicle/chronicle_w_labels

• Replace the port and IP address as required in your infrastructure.
  • Replace <customer_id> with the actual customer ID.
  • Update /path/to/ingestion-authentication-file.json to the path where the authentication file was saved in the Get Google SecOps ingestion authentication file section.

Restart the Bindplane agent to apply the changes

• To restart the Bindplane agent in Linux, run the following command:

   sudo  
  systemctl  
  restart  
  bindplane-agent 
  

• To restart the Bindplane agent in Windows, you can either use the Servicesconsole or enter the following command:

   net stop BindPlaneAgent && net start BindPlaneAgent 
  

Configure Syslog for Deep Instinct EDR

1. Sign in to the Deep Instinct Management Console.
2. Go to Settings > Integrations.
3. Click the + Addbutton.
4. Provide the following configuration details:
   • Name: Enter a descriptive name (for example, Google SecOps Bindplane ).
   • Host: Enter the Bindplane Agent IP address.
   • Port: Enter the Bindplane Agent port number.
   • Protocol: Select UDPor TCP, depending on your actual Bindplane Agent configuration.
   • Format: Select LEEF.
   • Timezone: Select the UTC timezone for consistency across systems.
   • Go to the Eventssection and select all.
5. Click the Save.

UDM Mapping Table

Log Field	UDM Mapping	Logic
act	security_result.action_details	Directly mapped from the act field.
app	principal.application	Directly mapped from the app field.
devTime	metadata.event_timestamp	Directly mapped from the devTime field.
deviceGroup	principal.group.group_display_name	Directly mapped from the deviceGroup field.
eventExternalId	metadata.product_log_id	Directly mapped from the eventExternalId field.
eventType	metadata.product_event_type	Directly mapped from the eventType field.
filePath	principal.process.file.full_path	Directly mapped from the filePath field.
fileType	principal.process.file.file_type	Mapped from the fileType field. If fileType is "POWERSHELL_INTERACTIVE", the UDM value is set to "FILE_TYPE_POWERSHELL".
host	principal.hostname	Directly mapped from the host field.
identHostName	target.hostname	Directly mapped from the identHostName field.
identSrc	target.ip	Directly mapped from the identSrc field.
LoggedInUsers	principal.user.userid	Mapped from the LoggedInUsers field after removing "REGISGROUP" and any backslashes.
log_type	metadata.log_type	Directly mapped from the log_type field.
OSName	principal.asset.platform_software.platform	Mapped from the OSName field, converted to uppercase.
OSVersion	principal.asset.platform_software.platform_version	Directly mapped from the OSVersion field.
sev	security_result.severity_details	Directly mapped from the sev field. Hardcoded to "STATUS_UPDATE" in the parser. Hardcoded to "Deep Instinct EDR" in the parser. Directly mapped from the vendor_name field extracted by grok. Directly mapped from the srcMAC field. Directly mapped from the usrName field. Hardcoded to "MEDIUM" in the parser.
srcMAC	principal.mac	Directly mapped from the srcMAC field.
usrName	principal.user.user_display_name	Directly mapped from the usrName field.

Need more help? Get answers from Community members and Google SecOps professionals.